Make ACPX session saves reliable at prompt completion #933

Story

As a person running Agent prompts through ACPX, I want session state saved reliably when a prompt finishes, so a returned reply does not fail the surrounding XMD entry because a temporary session file disappears before publication.

Observed failure

In a saved xmd repl entry collecting twelve ballots, eight prompts completed. The ninth agent returned valid ballot JSON, but its canonical prompt result recorded status: "failed" with:

ENOENT: no such file or directory, rename
<session>.json.<pid>.<timestamp>.tmp -> <session>.json

The entry's root-close record contains the same AgentPromptError. Its Prompt uses throwOnError={true}, so execution stops before validating that reply or starting the final three prompts. The returned text is preserved in the REPL journal.

This establishes a session-persistence failure, not invalid ballot JSON. The journal does not establish why the temporary file was unavailable.

Investigation and correction

The vendored FileSessionStore.save() in packages/acp/vendor/acpx/generated/runtime.js derives a temporary filename from the destination, process ID, and Date.now(), then writes and renames it.

Overlapping saves of the same session within one millisecond could select the same temporary path. That is a hypothesis to test, not the confirmed cause of the observed run. Trace prompt completion and live-checkpoint save ownership, as well as other possible deletion/rename paths, before selecting the correction.

• Establish a deterministic reproduction of the missing-file failure without calling a real agent.
• Correct the demonstrated persistence defect using the repository's existing vendored ACPX source/patch/regeneration process.
• Preserve atomic publication and the intended ordering of session/checkpoint updates.
• Do not hide save errors, mark an uncommitted session update successful, or automatically repeat a provider prompt to repair persistence.
• Keep actual I/O failures observable with the original failure evidence.

Acceptance

• The focused reproduction fails against the prior save behavior and passes with the correction.
• Prompt completion and checkpoint persistence cannot consume or remove each other's temporary files under the reproduced conditions.
• Successfully published session data remains readable and reflects the intended update order.
• A genuine write or rename failure still fails visibly rather than publishing success.
• An already returned reply remains inspectable when persistence fails; diagnosing or reopening the saved failure does not automatically reprompt the agent.
• The focused tests use deterministic scheduling/fixtures rather than repeated live-agent retries.

Relationships and scope

Separate persistence defect discovered while using #883 / PR #921. It is outside the Sidekick UI correction and does not add acceptance to that delivery.

#932 owns supported Sidekick access to saved entry diagnostics. That API is not required to reproduce or fix this defect. #922 owns the unrelated Parse failure behavior.

No automatic retry of the twelve-voter entry, modification of the user's session files, weakening of durable success criteria, general Agent orchestration change, or assumption that every ENOENT has the same cause is included.